Check the actual amounts transferred

[code423n4]

Handle

pauliax

Vulnerability details

Impact

Consider checking the actual amount transferred, e.g. in function addBounty as otherwise, you may have trouble with non-standard tokens, e.g. deflationary with a fee on transfer. The actual amount transferred is balanceOf the token before and after.

Recommended Mitigation Steps

uint256 before = IERC20(token).balanceOf(address(this));
token.safeTransferFrom(msg.sender, address(this), amount);
uint256 after = IERC20(token).balanceOf(address(this));
amount = after - before;

[frank-beard]

#236

[GalloDaSballo]

This finding comments on the correctness of trusting input vs actually checking what the changed balance is.
There is no clear "attack" nor way to brick or grief the protocol.
Agree with finding and severity